build(fdroid): drop AGP dependency-metadata block; release v2.7.5 #25

makiolaj · 2026-06-21T18:49:16Z

makiolaj commented

2026-06-21 18:49:16 +00:00

Release v2.7.5 — clear the last official-F-Droid blocker

When the fdroiddata MR (!40967) pipeline ran on v2.7.4, fdroid build and schema validation passed — but the check apk job rejected our published binary:

Problem: found extra signing block 'Dependency metadata'

That's AGP's dependency-metadata block (id 0x504b4453, ~8 KB) embedded in the APK Signing Block. F-Droid bans any extra signing block.

Fix

dependenciesInfo { includeInApk = false; includeInBundle = false } in app/build.gradle.kts.

The block lives in the signing block, not the zip entries, so removing it changes no build output — which is exactly why v2.7.4 still built reproducibly on F-Droid's side (fdroid build passed) while check apk failed. Verified locally: a releaseTest build now carries only the v2 signature + verity padding — the 0x504b4453 block is gone.

Blocker history (all now cleared)

vcsInfo { include = false } — VCS-info textproto (since 2.7.3)
foojay toolchain resolver removed — offline-build scanner (since 2.7.4)
dependency-metadata block disabled — binary scanner (this release)

Changes

dependenciesInfo off; bump → 2.7.5 / 20705; CHANGELOG + synced 20705.txt; recipe draft → v2.7.5.

On-device

Functionally identical to the on-device-verified v2.7.4 (only the signing block + version differ). Merging triggers the release pipeline → publishes calendula_v2.7.5.apk, tags v2.7.5. I'll then re-verify reproducibility and update the fdroiddata MR to v2.7.5.

🤖 Generated with Claude Code

## Release v2.7.5 — clear the last official-F-Droid blocker When the fdroiddata MR (!40967) pipeline ran on v2.7.4, **`fdroid build` and `schema validation` passed** — but the `check apk` job rejected our published binary: > `Problem: found extra signing block 'Dependency metadata'` That's AGP's dependency-metadata block (id `0x504b4453`, ~8 KB) embedded in the APK Signing Block. F-Droid bans any extra signing block. ### Fix `dependenciesInfo { includeInApk = false; includeInBundle = false }` in `app/build.gradle.kts`. The block lives in the **signing block, not the zip entries**, so removing it changes no build output — which is exactly why v2.7.4 still built reproducibly on F-Droid's side (`fdroid build` passed) while `check apk` failed. **Verified locally:** a `releaseTest` build now carries only the v2 signature + verity padding — the `0x504b4453` block is gone. ### Blocker history (all now cleared) - `vcsInfo { include = false }` — VCS-info textproto (since 2.7.3) - foojay toolchain resolver removed — offline-build scanner (since 2.7.4) - **dependency-metadata block disabled — binary scanner (this release)** ### Changes - `dependenciesInfo` off; bump → **2.7.5 / 20705**; CHANGELOG + synced `20705.txt`; recipe draft → v2.7.5. ### On-device Functionally identical to the on-device-verified v2.7.4 (only the signing block + version differ). Merging triggers the release pipeline → publishes `calendula_v2.7.5.apk`, tags `v2.7.5`. I'll then re-verify reproducibility and update the fdroiddata MR to v2.7.5. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

makiolaj added 1 commit 2026-06-21 18:49:17 +00:00

build(fdroid): drop AGP dependency-metadata block; release v2.7.5

CI / ci (pull_request) Successful in 5m57s

Details

5c80f99179

F-Droid's binary scanner (the fdroiddata `check apk` job) rejects any
"extra signing block". Our release APK carried AGP's dependency-metadata
block (id 0x504b4453, ~8 KB) in the APK Signing Block. Disable it with
`dependenciesInfo { includeInApk = false; includeInBundle = false }`.

The block lives in the signing block, not the zip entries, so removing it
changes no build output — v2.7.5 is functionally identical to 2.7.4 and
still reproduces byte-for-byte. Verified locally: a releaseTest build now
carries only the v2 signature + verity padding (no 0x504b4453 block).

This was the last F-Droid blocker: v2.7.5 now clears vcsInfo (since 2.7.3),
foojay (since 2.7.4) and the dependency-metadata block. Bumps versionName
to 2.7.5 and retargets the official recipe draft at v2.7.5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

makiolaj merged commit d0b6823385 into main

2026-06-21 19:00:44 +00:00

makiolaj referenced this issue from a commit

2026-06-21 19:00:45 +00:00

Merge pull request 'build(fdroid): drop AGP dependency-metadata block; release v2.7.5' (#25) from release/v2.7.5 into main

makiolaj referenced this issue from a commit

2026-07-06 20:02:46 +00:00

feat: show calendar-week numbers in Month view (#25)

makiolaj referenced this pull request

2026-07-06 20:25:03 +00:00

feat: week-of-year numbers in Month view (#25) #64

makiolaj referenced this issue from a commit